Linux Distros Unpatched Vulnerability : CVE-2026-123339

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(377543);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/11/10");

  script_cve_id("CVE-2026-123339");

  script_name(english:"Linux Distros Unpatched Vulnerability : CVE-2026-123339");

  script_set_attribute(attribute:"synopsis", value:
"The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be
patched.");
  script_set_attribute(attribute:"description", value:
"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied
patch available.

  - Improper trust of forwarded headers in RouterListener::onKernelFinishRequest() in Symfony HttpKernel
    versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11 allows a
    remote attacker to control the host, scheme, and port of absolute URLs generated for the rest of the
    request, poisoning links in pages stored by a shared cache and in e-mails sent after the page was
    rendered.When a page renders an inline fragment (render() in Twig, or an ESI tag rendered inline),
    SubRequestHandler temporarily adds 127.0.0.1 to the trusted proxies, and RouterListener rebuilds the
    router context from the main request while that trust is still active, so the X-Forwarded-* and Forwarded
    headers of a request whose client address is 127.0.0.1 are trusted even though that address is not a
    configured trusted proxy. From that point on, every absolute URL the router generates for the rest of the
    main request takes its host, scheme, and port from headers sent by the client, including URLs produced by
    url() in Twig and by UrlGeneratorInterface::ABSOLUTE_URL. Applications are affected when they are reached
    over HTTP from 127.0.0.1, for example behind a TLS terminator, reverse proxy, local HTTP cache, or sidecar
    proxy on the same host, and that proxy passes the client's forwarded headers along. With the default
    configuration (framework.trusted_proxies unset), all forwarded headers, including X-Forwarded-Host, are
    trusted during that window. Applications served through php-fpm, mod_php, or a proxy on another host are
    not affected. When framework.trusted_hosts is configured, a forwarded host outside the list is rejected,
    but the scheme and port can still be changed. (CVE-2026-123339)

Note that Nessus relies on the presence of the package as reported by the vendor.");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-123339");
  script_set_attribute(attribute:"see_also", value:"https://ubuntu.com/security/CVE-2026-123339");
  script_set_attribute(attribute:"solution", value:
"There is no known solution at this time.");
  script_set_attribute(attribute:"agent", value:"unix");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:H/Au:N/C:N/I:P/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:U/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:U/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:U");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-123339");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_set_attribute(attribute:"vendor_unpatched", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/11/06");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/11/07");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:16.04:-:lts");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:18.04:-:lts");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:20.04:-:lts");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:22.04:-:lts");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:24.04:-:lts");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:26.04:-:lts");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:26.10");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:12.0");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:symfony");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:symfony");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl", "set_linux_os_id.nasl");
  script_require_keys("Host/cpu", "Host/local_checks_enabled", "global_settings/vendor_unpatched", "Host/OS/identifier");
  script_require_ports("Host/OS/Debian Linux-12", "Host/OS/Ubuntu Linux-16.04", "Host/OS/Ubuntu Linux-18.04", "Host/OS/Ubuntu Linux-20.04", "Host/OS/Ubuntu Linux-22.04", "Host/OS/Ubuntu Linux-24.04", "Host/OS/Ubuntu Linux-26.04", "Host/OS/Ubuntu Linux-26.10");

  exit(0);
}

if (!get_kb_item("global_settings/vendor_unpatched")) exit(0, "Unpatched Vulnerabilities Detection not active.");
if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (empty_or_null(get_one_kb_item("Host/Debian/dpkg-l"))) audit(AUDIT_PACKAGE_LIST_MISSING);

include('linux_unpatched.inc');

var distro_constraints_array = {
  "Debian Linux-12": {
    "package_manager": "dpkg-l",
    "constraints": [
      {
        "release": "12",
        "pkgs": [
          {"reference": "php-symfony"},
          {"reference": "php-symfony-asset"},
          {"reference": "php-symfony-browser-kit"},
          {"reference": "php-symfony-cache"},
          {"reference": "php-symfony-config"},
          {"reference": "php-symfony-console"},
          {"reference": "php-symfony-css-selector"},
          {"reference": "php-symfony-dependency-injection"},
          {"reference": "php-symfony-dom-crawler"},
          {"reference": "php-symfony-dotenv"},
          {"reference": "php-symfony-error-handler"},
          {"reference": "php-symfony-event-dispatcher"},
          {"reference": "php-symfony-expression-language"},
          {"reference": "php-symfony-filesystem"},
          {"reference": "php-symfony-finder"},
          {"reference": "php-symfony-form"},
          {"reference": "php-symfony-http-client"},
          {"reference": "php-symfony-http-foundation"},
          {"reference": "php-symfony-http-kernel"},
          {"reference": "php-symfony-inflector"},
          {"reference": "php-symfony-intl"},
          {"reference": "php-symfony-ldap"},
          {"reference": "php-symfony-lock"},
          {"reference": "php-symfony-mailer"},
          {"reference": "php-symfony-messenger"},
          {"reference": "php-symfony-mime"},
          {"reference": "php-symfony-notifier"},
          {"reference": "php-symfony-options-resolver"},
          {"reference": "php-symfony-password-hasher"},
          {"reference": "php-symfony-process"},
          {"reference": "php-symfony-property-access"},
          {"reference": "php-symfony-property-info"},
          {"reference": "php-symfony-rate-limiter"},
          {"reference": "php-symfony-routing"},
          {"reference": "php-symfony-runtime"},
          {"reference": "php-symfony-security-core"},
          {"reference": "php-symfony-security-csrf"},
          {"reference": "php-symfony-security-guard"},
          {"reference": "php-symfony-security-http"},
          {"reference": "php-symfony-semaphore"},
          {"reference": "php-symfony-serializer"}
        ]
      }
    ]
  },
  "Ubuntu Linux-16.04": {
    "package_manager": "dpkg-l",
    "constraints": [
      {
        "release": "16.04",
        "pkgs": [
          {"reference": "symfony"}
        ]
      }
    ]
  },
  "Ubuntu Linux-18.04": {
    "package_manager": "dpkg-l",
    "constraints": [
      {
        "release": "18.04",
        "pkgs": [
          {"reference": "symfony"}
        ]
      }
    ]
  },
  "Ubuntu Linux-20.04": {
    "package_manager": "dpkg-l",
    "constraints": [
      {
        "release": "20.04",
        "pkgs": [
          {"reference": "symfony"}
        ]
      }
    ]
  },
  "Ubuntu Linux-22.04": {
    "package_manager": "dpkg-l",
    "constraints": [
      {
        "release": "22.04",
        "pkgs": [
          {"reference": "symfony"}
        ]
      }
    ]
  },
  "Ubuntu Linux-24.04": {
    "package_manager": "dpkg-l",
    "constraints": [
      {
        "release": "24.04",
        "pkgs": [
          {"reference": "symfony"}
        ]
      }
    ]
  },
  "Ubuntu Linux-26.04": {
    "package_manager": "dpkg-l",
    "constraints": [
      {
        "release": "26.04",
        "pkgs": [
          {"reference": "symfony"}
        ]
      }
    ]
  },
  "Ubuntu Linux-26.10": {
    "package_manager": "dpkg-l",
    "constraints": [
      {
        "release": "26.10",
        "pkgs": [
          {"reference": "symfony"}
        ]
      }
    ]
  }
};

var distro_constraints_values = linux_unpatched::get_distro_constraints(distro_constraints_arr:distro_constraints_array);
if (empty_or_null(distro_constraints_values)) audit(AUDIT_HOST_NOT, 'affected');

var third_party_support = get_kb_item('Host/OS/extended-third-party');
if (!empty_or_null(third_party_support)) {
    var third_party_vendors = distro_constraints_values['third_party'];
    if (!empty_or_null(third_party_vendors)) {
        var vendor;
        foreach vendor (third_party_vendors) {
            if (vendor == third_party_support) exit(0, 'A third party management patch is available for this vulnerability from ' + vendor + '.\n');
        }
    }
}

var report = linux_unpatched::check_unpatched_constraints(distro_constraints_values:distro_constraints_values);

if (!empty_or_null(report))
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_NOTE,
      extra      : report
  );
  exit(0);
}
else
{
  audit(AUDIT_HOST_NOT, 'affected');
}